As the dominant container orchestration system, Kubernetes has a large ecosystem of third-party applications. The third-party Kubernetes applications access various cluster resources to extend the cluster functionality and Kubernetes adopts the RBAC mechanism to manage the resource access permissions. Recently, researchers revealed that third-party applications are granted excessive permissions and proposed an excessive permission attack. The attacker can exploit some critical excessive permissions to escape from the worker node and take over the whole Kubernetes cluster. However, this attack assumes that the attacker has compromised a worker node via container escape, which is difficult to realize in real scenarios. Therefore, we propose a new excessive permission attack with simpler attack conditions in this paper. We reveal that an attacker who has compromised one pod (less difficult than compromising a worker node) can exploit some other excessive privileges to take over worker nodes or break the availability and data confidentiality of other pods. Although excessive permissions of third-party applications pose a great threat to the security of Kubernetes clusters, there is no effective approach for detecting them. In this paper, we propose a novel approach, namely EPScan, which automatically detects exploitable excessive permissions in third-party applications. To achieve this, EPScan employs a novel pod-oriented program analysis, which utilizes several new techniques to accurately identify the resource access behavior of the programs running in each pod. EPScan then compares the permissions required for these behaviors with those requested by the pod in its configuration file and finally reports the exploitable permissions that can be abused to launch an excessive permissions attack. We applied EPScan on 108 third-party applications from the CNCF projects and discovered previously unknown exploitable excessive permissions in 106 pods across 50 applications with a precision of 94.6% and 9 CVE identifiers assigned.

As a successful application of machine learning in remote sensing and natural language processing, image captioning of remote-sensing images has been promoted and developed. Remote sensing images are large in width, complex in features, and contain abundant information. It is a difficult task to extract available visual features based domain knowledge behind sufficiently and to utilize extracted feature for image captioning generation sufficiently. In order to overcome this difficulty, we propose a novel model based “encoder-decoder” framework, termed remote sensing image captioning with sequential attention and flexible word correlation (SA-FWC). In the encoder, we fuse features of different layers in VGG16 to extract global and local information. In the decoder, we propose sequential attention and flexible word correlation (SA-FWC) to utilize extracted visual information to generate accurate image captioning sufficiently. Specially, to utilize visual features from the encoding layer sufficiently, highlight important information and reduce redundant information, long short-term memory (LSTM) in SA-FWC is used for obtaining better feature representations. Feature fusion strategy and self-attention mechanism to utilize visual features sufficiently. Additionally, we provide a data augmentation strategy based minimal training sample pairs. In the experiments, four evaluation metrics are used to evaluate the experimental results, and the effects of various parameters on the experimental results are discussed. The experimental results (BELU-0.72, ROUGE-0.65, METEOR-0.37, and CIDEr-2.83) show that the proposed method is effective and outperforms other network structures.